Google API keys weren't secrets, but then Gemini changed the rules
trufflesecurity.com
Google API keys weren't secrets, but then Gemini changed the rules
1–10 of 326 posts
Re: Google API keys weren't secrets, but then Gemini changed the rules
#2Great write-up. Hilarious situation where no one (except unwieldiness) is the villain.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#3ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#4What's frustrating is that a lot of these keys were generated a long time ago with a small amount of GCP services that they could connect to. (Ex. Firebase remote config, firestore, etc.)
When Gemini came around, rather than that service being disabled by default for those keys, Gemini was enabled, allowing exploiters to easily utilize these keys (Ex. a "public" key stored in an APK file)
Re: Google API keys weren't secrets, but then Gemini changed the rules
#5ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.
How do you know that this blog post was written by ChatGPT?
Re: Google API keys weren't secrets, but then Gemini changed the rules
#6> Leaked key blocking. They are defaulting to blocking API keys that are discovered as leaked and used with the Gemini API.
There are no "leaked" keys if google hasn't been calling them a secret.
They should ideally prevent all keys created before Gemini from accessing Gemini. It would be funny(though not surprising) if their leaked key "discovery" has false positives and starts blocking keys from Gemini.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#7ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.
How do you know that this blog post was written by ChatGPT?
It's too structured and consistent. Imo. Has that AI smell to it, but I guess humans will eventually also start writing more like the AIs they learn from.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#8Private data should not be allowed to be accessed using public keys. That is the core problem. It is not about Google API keys are secret or not.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#9ChatGPT writing a blog post attacking Gemini security flaws. It's their world now, we're just watching how it plays out.
How do you know that this blog post was written by ChatGPT?
> The Core Problem
> What You Should Do Right Now
> Bonus: Scan with TruffleHog.
> TruffleHog will verify whether discovered keys are live and have Gemini access, so you'll know exactly which keys are exposed and active, not just which ones match a regular expression.
I don't know exactly, but I'm sure. The cadence, the clarity, the bolding, the italics, it's all just crisp and clean structured and actionable in a way that a meandering human would not distill it down to.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#10This is true but also not as new as the author claims. There have been various ways to abuse Google API keys in the past (at least to abuse them financially) and it’s always been very confusing for developers.